Phase 3 (part 1): harden the results tab and manifest

[jochen-testingbot]

Phase 3 of MODERNIZATION.md, split into a focused, low-risk first part: security + correctness + UX fixes to the build-results tab and a manifest cleanup. It deliberately does not touch the /mini viewer or do the SDK/React port (see Deferred below).

What changed

Results tab (tb-build-info)

• 3.1 — Removed the SRI-less unpkg.com/text-encoding <script> from infoTab.html. It was a supply-chain risk on a credential-holding page and pure dead weight — window.TextDecoder is native in every browser Azure DevOps supports (its only use, info.js, already calls the native one).
• 3.5 — embedDialog now only frames https://testingbot.com URLs; anything else renders a message instead of loading an attacker-suppliable page. (dialog.js)
• 3.4 — info.js pagination/UX:
  • Use a stable page size captured from the first (offset 0) response instead of the current page's count. This fixes corrupted page links/offsets after navigating to a partial last page.
  • Guard against an infinite loop when count is 0.
  • Render an error state instead of leaving "LOADING" up forever; wrap pagination clicks in try/catch; guard build.orchestrationPlan.

Manifest (3.6)

• Rebrand "Visual Studio Team Services" / VSTS → Azure DevOps.
• Cut scopes to the minimum actually used: vso.build + vso.serviceendpoint_query (dropped vso.build_execute, vso.test, vso.test_write, vso.serviceendpoint_manage).

Deferred / blocked (documented in MODERNIZATION.md)

• Removing the API secret from the browser (finding Bump bl from 1.2.2 to 1.2.3 #1) is blocked. The embedded /mini viewer needs md5(key:secret:session_id), and the TestingBot public API exposes no endpoint that returns that share hash server-side (only PUT test[public], which returns nothing). So keeping /mini — which you asked to keep — keeps the secret in the build attachment until TestingBot adds a share-hash/URL endpoint. The tab is otherwise untouched.
• The vss-web-extension-sdk → azure-devops-extension-sdk / React port is large, and the old SDK keeps working indefinitely, so it's a separate later PR.

Verification

• npm run package builds the vsix: no unpkg in the bundled infoTab.html, and the compiled manifest carries the reduced scopes + new name.
• Unit-checked the pure logic: URL allowlist (accepts testingbot.com/subdomains over https; rejects http, other hosts, testingbot.com.evil.com, javascript:, undefined) and pagination math (correct page list with a partial last page highlighted; count=0 skipped).

⚠️ Before release

These are browser/manifest changes I can't exercise outside a live Azure DevOps org. Smoke-test the results tab (attachment load + API call) with the packaged vsix before publishing, and note the reduced scopes force installed users to re-authorize on upgrade.

Summary by CodeRabbit

• Bug Fixes

  • Improved build-result pagination consistency and navigation.
  • Added clearer error messages for missing results, unavailable builds, and loading failures.
  • Prevented invalid dialog URLs from loading.
  • Removed reliance on an external text-encoding resource.

• Updates

  • Updated extension branding to Azure DevOps.
  • Reduced requested permissions; existing installations may require reauthorization.
  • Added release documentation covering validation and smoke testing.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: ff22c320-ed00-432c-bb65-fa959b5e2cff

📥 Commits

Reviewing files that changed from the base of the PR and between 6397f7f and cf8956e.

📒 Files selected for processing (5)

• MODERNIZATION.md
• tb-build-info/infoTab.html
• tb-build-info/scripts/dialog.js
• tb-build-info/scripts/info.js
• vss-extension.json

💤 Files with no reviewable changes (1)

• tb-build-info/infoTab.html

---

📝 Walkthrough

Walkthrough

The extension is rebranded for Azure DevOps, uses reduced scopes, removes an external script dependency, validates dialog URLs, and improves results pagination and error rendering. Modernization documentation records completed hardening work and remaining server-side signing and SDK migration tasks.

Changes

Azure DevOps modernization

Layer / File(s)	Summary
Manifest identity, scopes, and release status vss-extension.json, MODERNIZATION.md	Manifest terminology and permission scopes are updated for Azure DevOps, while the modernization plan documents PR #19 status, validation limits, smoke testing, and reauthorization requirements.
Embedded interface hardening tb-build-info/infoTab.html, tb-build-info/scripts/dialog.js, tb-build-info/scripts/info.js	The local SDK replaces the external polyfill, dialog iframe URLs are restricted to HTTPS TestingBot hosts, and result pagination uses a stable page size with centralized handling for missing data and load failures.

Estimated code review effort: 3 (Moderate) | ~20 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main changes: hardening the results tab and updating the manifest.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

---

_{Comment @coderabbitai help to get the list of available commands.}